Hacker News Reader

Comment by lsh | Hacker News Reader

I have dozens of unique domain names to secure and growing. The cost of buying an individual cert for each one is prohibitive. What can be done instead?

View on HN

StartSSL will let you do a multi-domain wildcard cert for $75 for 2-years (with identity verification). You toss all of your root domains on a single cert as wildcards, and use it everywhere. Cert lasts for 2 years and can be updated at any time to add new wildcard domains to it. You could in theory get 4 years out of it by adding a domain on the last day if your identity verification 2-year cycle, which refreshes the 2 years on the cert.

I use this method and it is awesome. One big multi-domain wildcard cert for everything.

> StartSSL will let you do a multi-domain wildcard cert for $75 for 2-years (with identity verification)

I think that is this product: https://startssl.com/?app=2

A comparison of their features is here: https://startssl.com/?app=40

"multi-domain" is what I'm after, right? I manage many domain names all pointing to a single IP.

I believe you need to buy the identity cert first ($60/year) and then the org cert ($60/year), so more like $120 a year if you want the org cert, but still a good deal.

StartSSL seem technically competent, but at the $100+ per year they no longer become the cheapest and I don't have to put up with their dodgy-as-hell website.

Comodo via Namecheap seem to have better pricing and less weirdness: https://www.namecheap.com/ssl-certificates/comodo/multi-doma...

Edit: I take that back. The above link is deceptive and the price charged is for the default number of domains that come with the package. Any additional domains cost extra. This is such a headache already. Lets not devolve this thread into price comparisons and end it here.

That's $120/year for unlimited certs (for the same owner) though...

yup - shopping around isn't coming up with any actual competitors for StartSSL. Would love to know if there are any. Selling the boss on giving copies of a lot of personally identifying (sensitive) information to a company with that kind of site is going to be hard :( If only they didn't look like they were 10 years old...

Sounds good, but StartCom's certificates don't appear to be recognized by Oracle's Java out of the box; this should be a show-stopper for anyone who is providing a Web API.

No it's not, it's literally $0. https://startssl.com/?app=1

Except for anything that might actually involve liability. Put "shop" in the domain for which you want a free certificate and you will have it rejected by Startssl.com

that was helpful making a decision, thankyou.

Their free cert is for non-commercial use only per their terms of service / certificate policy.

I recently tried the free startssl cert.

Fine on IOS/OSX/W7 Chrome/Safari/Firefox/IE but it was rejected by Android default browser where startssl must not be a known CA.

I don't think I can do without Android.

I have no issues with their certs on android 2.3.

Either you misconfigured it or you tested using Android <2.1[1] which accounts for less than 1% Android users.

https://code.google.com/p/android/issues/detail?id=21632

Thanks for the link, it helped me get there. I followed the documentation and tutorials for nodejs/express which defined the cert and key. As your link suggested, mobile browsers are less lenient about missing intermediate ca information so adding this solved it:

    var express = require('express'),
        path = require('path'),
        http = require('http'),
        https = require('https'),
        fs = require ('fs');
    
    var app = express();
    
    var options = {
      key: fs.readFileSync('cert/rsa.key'),
      cert: fs.readFileSync('cert/rsa.crt'),
      ca: fs.readFileSync('cert/sub.class1.server.ca.pem') // needed this
    };

    https.createServer(options, app).listen(443);

If they have to be SLD then there's not really anything you can do as to avoid the number of individual certs.

In terms of cost two obvious choices arise:

* Maybe look into becoming a cert reseller? * Make your own CA. You could then bundle, but you'd still need the individual certs either way.

You can afford dozens of $10 domain names, but dozens of $10 SSL certs would break the bank?

We host the service for our clients. Our clients choose and pay for their own domain name. The majority of our clients are not-for-profit.

It certainly wouldn't break the bank but it is an additional cost to doing business. The question was a little sly - I was fishing for the solutions my peers used by posing a beginners question. I hadn't heard of StartSSL before so it has been a success.

There are some CAs don't charge for certs, so unless you want an EV cert or something silly, them?

Reply on news.ycombinator.com